Stealth Spyware

[Adam]

I had to remove a bunch of spyware off of my sister's PC
but there is 1 or 2 things I cant get rid of.

When I look at the processes running in the task manager
I can see 2 that are spyware. I end the process and it
starts back up automatically but with a different name.

Ive used ad-aware and spybot and they dont detect them.

I even went into the registry and looked at all the "Run"
keys and deleted ones that I know is causing this
spyware, but guess what, when I reboot they re-appear but
with a different name.

Is there any way I can get this crap off of her PC
without formatting it?

 

[purplehaz]

The names of these processes aren't secret are they? Please post the names.
Sounds like spyware or a home page hijacker.

Run these tools:
spybot -- http://www.safer-networking.org/
ad-aware -- http://www.lavasoftusa.com/
HiJackThis - http://mjc1.com/mirror/hjt/

 

[Jim Macklin]

You could help by saying what the names are that these
programs use.


Also, install Zone Alarm (free version www.zonelabs.com )
and when you install it, don't give permission for any
program you don't want. Spyware that can't send is not as
harmful. It is still taking cycles. But when it asks, you
can say no.



message | I had to remove a bunch of spyware off of my sister's PC
| but there is 1 or 2 things I cant get rid of.
|
| When I look at the processes running in the task manager
| I can see 2 that are spyware. I end the process and it
| starts back up automatically but with a different name.
|
| Ive used ad-aware and spybot and they dont detect them.
|
| I even went into the registry and looked at all the "Run"
| keys and deleted ones that I know is causing this
| spyware, but guess what, when I reboot they re-appear but
| with a different name.
|
| Is there any way I can get this crap off of her PC
| without formatting it?

 

[Adam]

purplehaz I ran spybot and ad-aware which I said in my
original post. I would post the names of the processes
but I'm at work and my sister lives 45 minutes away from
here.

 

[Adam]

Hey Jim, I did install Zonealarm which I should have done
a long time ago. This spyware changes my proxy settings
and I have to periodically reset the proxy config. When
I find out the names of the processes, I will post them.

 

[Guest]

-----Original Message-----
I had to remove a bunch of spyware off of my sister's PC
but there is 1 or 2 things I cant get rid of.

When I look at the processes running in the task manager
I can see 2 that are spyware. I end the process and it
starts back up automatically but with a different name.

Ive used ad-aware and spybot and they dont detect them.

I even went into the registry and looked at all the "Run"
keys and deleted ones that I know is causing this
spyware, but guess what, when I reboot they re-appear but
with a different name.

Is there any way I can get this crap off of her PC
without formatting it?
.
Download "Hijackthis" and scan your system,Post the

results of the scan at www.spywareinfo.com for help in
removing whats left.

 

[purplehaz]

Ok, when you get a chance post the names. There are manual removal
procedures for different ones that adaware or spybot can't get.

 

[Jim Macklin]

Good luck!


message | Hey Jim, I did install Zonealarm which I should have done
| a long time ago. This spyware changes my proxy settings
| and I have to periodically reset the proxy config. When
| I find out the names of the processes, I will post them.
|
|
| >-----Original Message-----
| >You could help by saying what the names are that these
| >programs use.
| >
| >
| >Also, install Zone Alarm (free version www.zonelabs.com )
| >and when you install it, don't give permission for any
| >program you don't want. Spyware that can't send is not
| as
| >harmful. It is still taking cycles. But when it asks,
| you
| >can say no.
| >
| >
| >
| >message | >| I had to remove a bunch of spyware off of my sister's
| PC
| >| but there is 1 or 2 things I cant get rid of.
| >|
| >| When I look at the processes running in the task
| manager
| >| I can see 2 that are spyware. I end the process and it
| >| starts back up automatically but with a different name.
| >|
| >| Ive used ad-aware and spybot and they dont detect them.
| >|
| >| I even went into the registry and looked at all
| the "Run"
| >| keys and deleted ones that I know is causing this
| >| spyware, but guess what, when I reboot they re-appear
| but
| >| with a different name.
| >|
| >| Is there any way I can get this crap off of her PC
| >| without formatting it?
| >
| >
| >.
| >

 

[Unnamed]

I had to remove a bunch of spyware off of my sister's PC
but there is 1 or 2 things I cant get rid of.

When I look at the processes running in the task manager
I can see 2 that are spyware. I end the process and it
starts back up automatically but with a different name.

Ive used ad-aware and spybot and they dont detect them.

Just like to know 2 things:

1) What are the names of the processes?

2) Did you try UPDATING both Spybot and Adaware prior to RUNNING them on
your sister's PC? Don't forget that if you have Adaware version less than
6.181 then it hasn't been able to be updated since last July.